H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

UPSTYLE

[UPSTYLE](https://attack.mitre.org/software/S1164) is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. [UPSTYLE](https://attack.mitre.org/software/S1164) has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[UPSTYLE](https://attack.mitre.org/software/S1164) is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. [UPSTYLE](https://attack.mitre.org/software/S1164) has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

Labels

malware
13 recorded

Relationships

uses
from Operation MidnightEclipse
Campaign
uses
to Clear Linux or Mac System Logs
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Event Triggered Execution
Technique
uses
to File Deletion
Technique
uses
to Hide Infrastructure
Technique
uses
to Junk Data
Technique
uses
to Masquerading
Technique
uses
to One-Way Communication
Technique
uses
to Process Discovery
Technique
uses
to Python
Technique
uses
to Timestomp
Technique
3 external

References

mitre-attack
S1164
open
Palo Alto MidnightEclipse APR 2024
https://unit42.paloaltonetworks.com/cve-2024-3400/
open
Volexity UPSTYLE 2024
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance